Privacy policy

Who we are

This site is operated by SHURVEDA CHEM SPECIALITIES LLP, trading as Shurveda, a limited liability partnership registered in India at Office No.317, Sai Arcade, N.S. Road, Mulund (West), Mumbai - 400080, India. Our GSTIN is 27AFTFS0333Q1Z8. We are the controller of the personal data described below.

For anything about this policy, or about data we hold on you, write to sales@shurveda.com or to the registered address above. We have not appointed a statutory data protection officer — we are not required to, because we do not monitor people on a large scale and we hold no special-category data — so privacy questions go to that address and are handled by the partners.

We have not appointed a representative in the European Union or the United Kingdom under Article 27 of the GDPR, and we are taking advice on whether we are required to. Until that is resolved, buyers in the EU and the UK should use the contacts above, which we monitor.

There are no accounts on this site

You cannot register, and there is nothing to log into. Browsing the catalogue requires no personal data at all, and we do not ask for any until you choose to send us an enquiry. The only accounts that exist belong to our own staff, who publish the catalogue and read the enquiries.

When you send an enquiry

The quotation form appears on each product page, on the request-a-quote page and on the contact page. All three save the same record. This is everything it stores.

What you type

• Your name, your company name, your email address and, if you give it, your phone number.
• The product you are asking about — either the catalogue item you picked, or the text you typed if we could not match it to a grade we publish. We keep what you typed in either case, because it is the record of what you actually asked for.
• Quantity and unit, destination country, destination port and your preferred Incoterm, where you supply them.
• Your message, if you write one.
• One PDF attachment, if you add one — typically a specification or a drawing to quote against.

What your browser sends, which we record with it

• Your IP address. We use it to rate-limit the form against automated submissions, and we store it on the enquiry.
• Your browser’s user-agent string.
• The page you submitted from, and the referring URL your browser reported.
• Campaign parameters (utm_source, utm_medium, utm_campaign) if the link you arrived by carried them, so we know which listing or email brought you here.
• A spam score we calculate from the submission itself, and whether the submission was classified as spam. We work this out from a hidden field, how quickly the form was completed and the content of the message. We deliberately use no CAPTCHA, because that would hand a third party the IP address of everyone who enquires.

What we record about your consent

The form carries a tick-box, and we store that you ticked it, when you ticked it, and the exact version of the wording you were shown. “They agreed” means nothing without the second part, so the wording is versioned and old records keep the old version.

What we add afterwards

• A reference number, shown to you when the enquiry is sent and derived from the record itself.
• The enquiry’s status as we work it, and dated internal notes written by our staff. Those notes are about the enquiry, and you can ask for a copy of them.
• A log of each email we send about the enquiry: the address, the subject, whether it was accepted for delivery, and any error returned.

Why we are allowed to hold it

• To answer your enquiry: because you asked us to quote, and we cannot answer without it. Under the GDPR this is Article 6(1)(b) — steps taken at your request before entering a contract.
• To keep a record of what was asked and what we said: our legitimate interests in running the business and being able to evidence a quotation, under Article 6(1)(f).
• For the spam checks and the rate limit: our legitimate interests in keeping the form usable, under Article 6(1)(f).
• For analytics: your consent, and nothing else, under Article 6(1)(a). No analytics are running on this site at present — see the cookie policy — and nothing would be loaded unless you agreed to it first.

We do not sell your details, we do not share them with advertising networks, and we do not use them to build a profile of you. We do not make automated decisions about you.

Who else sees it

Our staff, and these service providers. Nobody else, and no advertiser.

• An email delivery provider, which sends the notification to us and the acknowledgement to you. It therefore handles your name, your email address and the contents of those two messages, and does nothing else with them. We will name the provider on this page once the account is live.
• A hosting provider, which runs the server and the database and therefore holds everything above at rest, along with ordinary server logs.

We would also disclose data where we are legally required to, or to take advice from our own professional advisers.

Where your data is held, and transfers out of your country

We are an Indian company and enquiry data is stored in India. If you are in the European Union or the United Kingdom, sending us an enquiry therefore transfers your data to a country that does not have an adequacy decision.

Standard contractual clauses are being put in place to cover that transfer, together with the UK addendum. They are not yet concluded, and we would rather say so than imply otherwise. If that matters to your own compliance position, write to sales@shurveda.com or to SHURVEDA CHEM SPECIALITIES LLP, Office No.317, Sai Arcade, N.S. Road, Mulund (West), Mumbai - 400080, India, and we will tell you exactly where it stands before you send us anything.

How long we keep it

We keep an enquiry for 12 months from the last activity on it — the last status change, internal note, or contact between us about it. After that the enquiry and any attachment are deleted. A live commercial relationship counts as activity, so an account we are actively quoting does not time out mid-conversation.

To be accurate about how that is done: the database records the date of last activity on every enquiry, and deletion is currently carried out as a periodic review by hand rather than by an automated job. The period above is the rule we apply.

You can ask us to delete your enquiry sooner, and we will, unless we are required to keep it — for example where it forms part of the record of a transaction we have tax or customs obligations about.

When an enquiry is deleted we keep a short record that it was: the reference number you were given, the date it arrived, the date it was deleted, who deleted it and why. That record holds no name, company, address, message or attachment — it is how we can show that a deletion was carried out, without keeping the thing we deleted.

How it is kept

• Attachments are stored outside the public web root, behind a route that checks for a staff session. They are never served from a public URL, and the filename you upload never becomes part of a path.
• We check an uploaded file by reading its contents, not by trusting its name, and we accept PDFs only.
• A PDF carries its own metadata — author, software, sometimes more — and we store the file as you sent it, so whatever is in it is kept too. If that matters to you, check the document before attaching it.
• Staff accounts use strong password hashing, lock after repeated failed logins, and can be signed out everywhere at once.
• The fonts on this site are served from our own server rather than a font CDN, so loading a page sends your IP address to nobody but us.

Your rights

If the GDPR applies to you, you can ask us for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to restrict or stop processing it, object to processing we base on legitimate interests, and ask for it in a portable form. Where we rely on your consent you can withdraw it at any time, and withdrawing is as easy as giving it — the cookie-choice link in the footer reopens that question whenever you want it.

You can also complain to a supervisory authority in the country you live or work in. If you are in the United Kingdom that is the Information Commissioner’s Office.

If you are in a US state with its own privacy statute — California, Colorado, Connecticut, Virginia and others — you may have comparable rights, including the right not to be treated differently for exercising them. We do not sell personal information and we do not share it for cross-context behavioural advertising.

India’s Digital Personal Data Protection Act 2023 applies to us as well. We will update this notice as its rules come into force.

To exercise any of this, write to sales@shurveda.com. We will ask enough to be sure it is your data we are handing over, and we aim to answer within one month.

Children

This is a business-to-business site for chemical procurement. It is not directed at children and we do not knowingly collect their data.

Changes

When this policy changes we will update the date at the top. If the change affects what we do with data we already hold, we will say so rather than quietly revise the page. The consent wording on the enquiry form and on the cookie banner is versioned separately, and changing either asks you again.